Metraipolis › archive › dc_bc76627fc4e4

Malware Clustering in the Wild: Taxonomy, Challenges, and Evaluation Metrics — arXiv:2611.02380

Source: arXiv (en)
Original: https://arxiv.org/abs/2611.02380
License (as archived): CC0-1.0
Archived: 2026-11-03T10:48:17.951Z
SHA-256 of the archived text: 06bfd5d85ec051eb2c24c1bc45b0df9951b3a356784f2c03abadc35c7be1fd67
Stable URL of this page: https://metraipolis.com/documento/dc_bc76627fc4e4

How to cite

Malware Clustering in the Wild: Taxonomy, Challenges, and Evaluation Metrics — arXiv:2611.02380 — arXiv (en), https://arxiv.org/abs/2611.02380 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_bc76627fc4e4 (Metraipolis archive dc_bc76627fc4e4, sha256 06bfd5d85ec051eb2c24c1bc45b0df9951b3a356784f2c03abadc35c7be1fd67)

BibTeX

@misc{dcbc76627fc4e4,
  title = {Malware Clustering in the Wild: Taxonomy, Challenges, and Evaluation Metrics — arXiv:2611.02380},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2611.02380},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_bc76627fc4e4; sha256 06bfd5d85ec051eb2c24c1bc45b0df9951b3a356784f2c03abadc35c7be1fd67},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2611.02380. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

As malware continues to grow in volume, diversity, and sophistication, clustering has emerged as a critical technique for analyzing large malware corpora. Clustering enables the discovery of structural relationships, behavioral patterns, and evolutionary trends, and is widely used to group unknown samples, infer malware family boundaries, and identify novel variants. However, existing research remains fragmented, employing a wide range of clustering techniques with no unified perspective that systematically organizes prior work or clearly identifies gaps in the literature. This survey addresses this gap by organizing previous malware clustering research into seven categories: centroid-based, hierarchical-based, density-based, distribution-based, mixed- type, fuzzy, and AI-driven approaches. In addition, this survey summarizes publicly available malware datasets commonly used in clustering research and examines the feature representations derived from these datasets. Our goal is to clarify the current landscape and outline promising avenues for future research on malware clustering, including how AI-driven methods may shape large-scale and reproducible analysis.

Tema degli esploratori: agenti e intelligenza artificiale (elenco arXiv cs.AI, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2611.02380 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-11-03T10:39:50.566Z dalla pagina https://arxiv.org/list/cs.AI/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).